PT-2026-22238 · Unknown · Websocket Backend

Khaled Sarieddine + 1 · Publicado 2026-02-26 · Atualizado 2026-03-04 · CVE-2026-20895

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WebSocket backend (affected versions not specified)

Description The backend utilizes charging station identifiers to uniquely associate sessions but permits multiple endpoints to connect using the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing. A recent connection can displace a legitimate charging station and receive backend commands intended for it. This may allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with session requests. The API endpoints are susceptible to this issue due to the handling of session identifiers. The vulnerability involves the manipulation of session identifiers, potentially affecting the session id variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2026-20895

Produtos afetados

Websocket Backend

Referências · 8

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-04.json · Nota
• https://cisa.gov/news-events/ics-advisories/icsa-26-057-04 · Nota
• https://twitter.com/CVEnew/status/2027466614439088621 · Publicação no Twitter
• https://twitter.com/cracbot/status/2028787714049638739 · Publicação no Twitter
• https://twitter.com/cracbot/status/2029149920830357921 · Publicação no Twitter
• https://t.me/cveNotify/153804 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-20895 · Nota de Segurança
• https://ev2go.io · Nota